search_logs
Search VMware Aria Operations for Logs events within a time window to find the log lines behind an incident. Returns timestamped events with fields for correlation and debugging.
Instructions
[READ] Search Log Insight events within a time window.
WHEN: to find the actual log lines behind an incident (e.g. what vmkernel logged during a storage event). For "where did logs burst?" use aggregate_logs instead; for vCenter alarms use vmware-monitor.
RETURNS: {count, complete (False if truncated), constraints, events: [{timestamp_ms, text, fields}]}, plus 'note' when limit was lowered. 'fields' is a flat {name: value} dict — hostname, appname, procid, source, facility and the other static fields the appliance attached (content-pack fields are not included: the query does not ask for them). Feed events to vmware-debug build_incident_timeline to correlate across sources. Read-only.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| last | No | Relative window ending now, as a quantity plus a unit suffix — s, m, h or d ("30m", "2h", "7d") — or a bare number of seconds. Anything else raises a ValueError naming the accepted forms. Cannot be combined with begin_ms/end_ms; passing both is refused. Omit all three and the query defaults to the last hour, so it is never unbounded. Windows longer than ~24.8 days are sent as an absolute start time, because the appliance's LAST operator overflows there. | |
| text | No | Word(s) matched against the event message with the CONTAINS operator. Log Insight matches whole words, not substrings: "localhost" finds "localhost.localdomain", "localdom" finds nothing, "localdom*" finds it again (`*` is a wildcard; verified on 8.18.7). When a text search matches nothing, 'note' says so — 0 events for a partial word is not evidence the logs do not exist. Not a regex and not a query expression. Omit to match every event in the window. This tool has no field-filter parameter; filter on a field's value by reading 'fields' in the result. | |
| limit | No | Maximum events returned, 1..200, default 50. A larger value is lowered to 200 and the result's 'note' says so. Each event is ~650 characters, so 50 is already ~8k tokens: narrow the window or the text rather than raising this. | |
| end_ms | No | Absolute window end as epoch milliseconds (not seconds). May be given without begin_ms, which then means "everything up to this instant". Cannot be combined with last. | |
| target | No | Log Insight target name as spelled in ~/.vmware-log-insight/config.yaml. Omit to use that file's default_target — with no default configured, omitting it is an error that lists the configured names. | |
| begin_ms | No | Absolute window start as epoch milliseconds (not seconds — a value that looks like seconds is refused). May be given without end_ms, which then means "from this instant onwards". Must be before end_ms. Cannot be combined with last. |